MALICIOUS — virussign.com_ac45676b12501078fdf12e5c28e33e20.vir

MALICIOUS — virussign.com_ac45676b12501078fdf12e5c28e33e20.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Muldrop family. 4 of 55 detection engines flagged it.

Identification

SHA-256: 12c22c3bf142c4b89b8d6b907237e12b7f28a256e47b47d0acdb4d658e248d08
SHA-1: ecda64a134b2d957e80666f54a03d61db84dcf33
MD5: ac45676b12501078fdf12e5c28e33e20
imphash: b7b1d154ca47a083b83fddc13f54b733
ssdeep: 3072:LVPyc4o55Rg3kxhfFX6oYy8VI3vMqgviuj:LVeom0hfhYrVI3Eqgviu
TLSH: T19C418FAF309249BFC30A63847BD018CC17E353DA21575CAAE148DA99D9B53FBAD90071
Submitted as: virussign.com_ac45676b12501078fdf12e5c28e33e20.vir
File type: pe · Size: 188461 bytes
Verdict: malicious (96/100) · Family: Muldrop

Source: VirusSign · first seen 2026-08-20T00:00:00.000Z · SHA-256 verified

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Midie-6847893-0
Microsoft Defender: TrojanDropper:Win32/Muldrop.V!MTB
Emsisoft (Emergency Kit): Gen:Heur.Conjar.9
Kaspersky (KVRT): Trojan.Win32.Agent.xcejpm

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Midie-6847893-0 (rule Win.Malware.Midie-6847893-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Contacted 27 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://purl.org/dc/elements/1.1/, http://www.iec.ch - static signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

27038 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://ns.adobe.com/xap/1.0/
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/photoshop/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/sType/ResourceRef#
http://www.iec.ch
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787849288&P2=404&P3=2&P4=HGks%2f3rA6lQk8nrelsXO5MytZLdhGRKAWuA89Xz3Bh17zn1fp2OowGQp2VbBv1NXAhoJFnsgTxOdMTmq2sdCHg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787849315&P2=404&P3=2&P4=fiGiOd3CdzfThQuJ7OjxoiQHIiOEIEmHK%2fLPPj1Ir1ykb%2bb7E03pTUeSjgqgGw2mEX39oduPnJ8cT7IRjmY%2bUg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ns.adobe.com
www.w3.org
purl.org
www.iec.ch

Embedded IP addresses

104.46.162.224
52.123.252.229
52.123.252.226
4.230.171.124
20.42.179.192
4.144.132.223
135.232.92.137
74.178.76.54
20.42.65.88
20.231.239.246
40.99.133.242
52.123.129.14
52.123.128.14
4.207.44.76
20.165.94.63
52.123.252.235
52.123.252.241
135.234.160.244
203.26.79.13
135.232.92.34
52.148.114.188
135.233.45.221
72.153.5.139
172.178.240.161
92.223.78.30

File paths

C:\Program

More Muldrop samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report